GreyNoise

PHP command injection flaw exploited to deliver ransomware (CVE-2024-4577)

June 13, 2024

An OS command injection vulnerability in Windows-based PHP (CVE-2024-4577) in CGI mode is being exploited by the TellYouThePass ransomware gang. Imperva says the attacks …

SolarWinds fixes severe Serv-U vulnerability (CVE-2024-28995)

June 7, 2024

SolarWinds has fixed a high-severity vulnerability (CVE-2024-28995) affecting its Serv-U managed file transfer (MFT) server solution, which could be exploited by …

Check Point VPN zero-day exploited since beginning of April (CVE-2024-24919)

May 31, 2024

Attackers have been exploiting CVE-2024-24919, a zero-day vulnerability in Check Point Security Gateways, to pinpoint and extract password hashes for local accounts, which …

Palo Alto firewalls: Public exploits, rising attacks, ineffective mitigation

April 17, 2024

UPDATE: April 30, 09:30 AM ET New story: Palo Alto firewalls: CVE-2024-3400 exploitation and PoCs for persistence after resets/upgrades While it initially seemed that …

92,000+ internet-facing D-Link NAS devices accessible via “backdoor” account (CVE-2024-3273)

April 8, 2024

A vulnerability (CVE-2024-3273) in four old D-Link NAS models could be exploited to compromise internet-facing devices, a threat researcher has found. The existence of the …

Critical FortiClient EMS vulnerability fixed, (fake?) PoC for sale (CVE-2023-48788)

March 14, 2024

A recently fixed SQL injection vulnerability (CVE-2023-48788) in Fortinet’s FortiClient Endpoint Management Server (EMS) solution has apparently piqued the interest of …

Akira, LockBit actively searching for vulnerable Cisco ASA devices

February 8, 2024

Akira and Lockbit ransomware groups are trying to breach Cisco ASA SSL VPN devices by exploiting several older vulnerabilities, security researcher Kevin Beaumont is warning. …

Ivanti EPMM and MobileIron Core vulnerability is actively exploited, CISA confirms (CVE-2023-35082)

January 19, 2024

A previously patched critical vulnerability (CVE-2023-35082) affecting Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core is being actively exploited, the Cybersecurity …

1,700 Ivanti VPN devices compromised. Are yours among them?

January 16, 2024

Over 1,700 Ivanti Connect Secure VPN devices worldwide have been compromised by attackers exploiting two zero-days with no patches currently available. “Additional …

Attackers are trying to exploit Apache Struts vulnerability (CVE-2023-50164)

December 14, 2023

Attackers are trying to leverage public proof-of-exploit (PoC) exploit code for CVE-2023-50164, the recently patched path traversal vulnerability in Apache Struts 2. …

Critical ownCloud flaw under attack (CVE-2023-49103)

November 28, 2023

Attackers are trying to exploit a critical information disclosure vulnerability (CVE-2023-49103) in ownCloud, a popular file sharing and collaboration platform used in …

Atlassian Confluence data-wiping vulnerability exploited

November 6, 2023

Threat actors are trying to exploit CVE-2023-22518, a critical Atlassian Confluence flaw that allows unauthenticated attackers to reset vulnerable instances’ database, …